f1381a36d685ed87cd93bea5673c19c3bf4ee8ad1e6a145afb6494f1ae9f2f3f

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.3MB
Sample260808-sz453aeb65
SHA256 f1381a36d685ed87cd93bea5673c19c3bf4ee8ad1e6a145afb6494f1ae9f2f3f
MD5 cb1632453e434d0dbe651c81dd1fcc8c
SHA1 9ff5ce83e9d91e4f9662c2cb47d6d806066e99ad
SHA512 d0ef04407f4816ab358403a8c9fe3fe54972c879b2e0fbf356306ed1d7078309f6f831e82c0197c470959c1191fea450d60423efd6ea2d615f711ca7679e9662
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouq:iZahvQHrc8u3xXJ/f4uUWHn
TLSH
T17907AE13B35681E6C42AE2B88A474223D7BA7C440334A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-19.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x00080000000182b1-393.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-19.dat	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/files/0x00080000000182b1-393.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-19.dat	INDICATOR_EXE_Packed_Yano
behavioral2/files/0x00080000000182b1-393.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-19.dat	UPX
behavioral2/files/0x00080000000182b1-393.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
3064	svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
4424	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAABCABABAAACACCACACACBBBCAABABCCBCABAACACCBBACABABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe"	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBACCBBBCBCBCCAAAACCAACACCAAAABCCAABCCBAAACAABCCABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe"	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1608	sc.exe
4324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2176	cmd.exe
1972	cmd.exe
2124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
3064	svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
3064	svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
4424	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
4424	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
Token: SeDebugPrivilege	3064	svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
Token: SeDebugPrivilege	4424	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2176	3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	93
PID 2176 wrote to memory of 932	2176	cmd.exe	95
PID 5008 wrote to memory of 1092	5008	svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe	96
PID 3464 wrote to memory of 1972	3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 1972 wrote to memory of 1608	1972	cmd.exe	101
PID 3464 wrote to memory of 2124	3464	2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	102
PID 2124 wrote to memory of 4324	2124	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb1632453e434d0dbe651c81dd1fcc8c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACBABCBACBBCCACBABCCABCBCCCBCACCABCABBACCBBCABBBBCCCBBABCBAAAAAABCABABCCCBBCCCCCBCCBCAABACBCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACBABCBACBBCCACBABCCABCBCCCBCACCABCABBACCBBCABBBBCCCBBABCBAAAAAABCABABCCCBBCCCCCBCCBCAABACBCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe" start= auto displayName= "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe" start= auto displayName= "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCCBBBBACBCBBBBACCCAACACBCACAACCCACBAACCAACBBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBCAACBCBABBABCAABCBCAACAAAAABAABCAAAACACABCAAACCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ebe9e9e0c1926ef2d59d6c3090998dc0a2f7ea0d1254033125cd30dff1b3f244
MD5 bd3d0ecebf74b6136582d5c51ee6909b
SHA1 db6296d0e35ea7c9f749482cfc1c2291ce103cca
SHA512 46c8a68b9e7b94cfe68552ca9a7b6edd361a0e597b2ac48a03f3a9d4c83560ea9f88bca59a401a384ad95d9da153e09cd6ca78fa41a44bb84137ade612de53b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 922d58bfa6bce7c52bc890455afc4ce30532629ec4b352e57a3ce07aea90c6fb
MD5 516b8cbdaf4a6dcf79b51c236311f238
SHA1 c42eec28ceb1a591996f58c5169bb06d05ce75ea
SHA512 1f1834a1b08c7fbcb0ab495141c3835042dbd3a0243a17feb8e524991543f398938d1ad78f84d25e467fe2923e203c30c68c06c61b11b8a75822ba8f6cce3820
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\qap`g`v~dtlq
Size 10B
SHA256 29f2d039ae3f406bbf75d6318dfb63aca9552ac71194e54eb2de367e4273b897
MD5 c7e9d452dd8dbaaa03bbc0910269baa3
SHA1 511eb7f89fd9879ba03130840f87d2e55a631cd2
SHA512 7a0a543f805ef0e37105635392a32b1e74d0f42cd12944bdace446fb46cef3ab1db4e57260cfc82bf0828e6d73c43f002a5a3bceec4d019baf68baa0239049e6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 16.9MB
SHA256 b6baef5af28d0463e950ecf96a02d4e931a4c781bb184fb1bab49c90a7557505
MD5 ba526e380a90b8803e80a23976f190d1
SHA1 f4978de0b51f61c60585e73c2a7e4b92618afd00
SHA512 f22e1dfc600842d309a5af3500d8a54ccf12f26cb629e53267bacd79a170324ddc9bdb377503a8afb25c9874e12eea2cacaee68098406addcd86e0c114149217
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToutgZ2jn:iZahvQHrc8u3xXJ/f4uUWHD2z
TLSH
T17807AE13B35681E6C42AE2B88A474223D7B9BC440334A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\qap`g`v~dtlq
Size 10B
SHA256 dd74f73351b76a855c6782140f7a21594e1e8b587c8be7e6b2f921a6d4d54a7b
MD5 21afa7d000323cf292afdf89a3eec300
SHA1 4f995e9f7239539f1afaa0f7f67fd8a63cf2da0d
SHA512 26f3b9b75e6503ad52991bdf98cd6e35e13eee202a9399525448181e88786ed9debef0d04862142a34cf86e0bd203605f3e7f8d2e42336ae4dcf5a9aaf3f2aff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 140a16ed6926cbaf009e029430b6234ae9ed15dc096827b611d320a45719eb87
MD5 fa5490680b20962715140cee153950bb
SHA1 f0d12323c87bf76aa940eea80b0dc5e83d5cbd32
SHA512 c176856c6463cfa3bfaebe69b810c240d724e7bd510e4b3fd95e9dc7062e494816eda57751c1ecd59462fedc8f8e2ae3c78c1501c2ea2689bb38c367ad7d25f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b41dcaa99e171e7dc0e1536bc8a21701b2b49a7ea0147c48dacf1ceb3058054a
MD5 4a4bfea2f94fce49cbf297f547c994b3
SHA1 8db6992ec865f8e8913259e5149e3a0d72c0dbaa
SHA512 391e362869b96a9769ce9a6e8f6bd4e32a4aff714815b3c8c2f0f0178ac384feaf7941e3ad8b3464242452ebac3e97f50df99d960387ca8d52121e91467f6848
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa6921d7205c82c0ce4254123e58ed524b33c01271d804fd234e1ecb4f6f5995
MD5 23ad046e32a5f34a448e54e659db0159
SHA1 49deb1ee5aaa799f4eed7baa3c3a61b7059c6d46
SHA512 7a7bcda8febd09369bddeec1cc386f8992e6789fec55161d8a188225092387a9dc7ec68a546c46aee2538cbe36f5ac67f7af97f8ad2e4f47176ecd537100bdbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7644453df4ad99548ff487192dd87b174eafd54d4c668622a846563387b2e563
MD5 73b7ecca45ab6286635bd77697ebf899
SHA1 33ea215291f31ebf8881ae71cf737f30cc1881a9
SHA512 e61b7d37a28e2b42c450b441f20e0a2b5d2e2164b6d8c54a29d11207a781d9b8adce41db54808a9a057c9e42f9e7da05ff34ab1a143aded96da14ac0a1239a02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8dfffe78d98bba0db5799fc570343e0642001f753e4ca435640dca79c2b48f62
MD5 12a0dfb9ddb784947f9edd27083ea5a2
SHA1 a243c7a26545e520b2ae2f071bce36bf025fe35f
SHA512 85be21032858db1537df12aa6bf420d02a88c09573fd52e13b0b58d0415a618c1417c029970105b2b057990cbcebfa0fa2d807475aa9c8552e66fa3c643228f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f733d7bbab463eab8d72a023e0fafd7732a9921f041ba783c44c8af4362a6bcb
MD5 7b77dceb344808e37dce547c68ccd3b4
SHA1 24ba8c6c0854920805038207bf93a0c0aed2ca50
SHA512 2c87190f34f290e6691aaa6695ea7c6f7f38676da44e23ca8423789a7ef19715a99e161324ca255d099454d19d401e9bb581991f281514a4ace38b12e8f83078
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 74dc61ce4be6d693c72b49a00dbc1cb2f26dec36e3a96ae553cfa3f2b9cfc3d0
MD5 8b026a7b7f3929411aee0e9b1c1e124d
SHA1 384a3d7f79c5a8b812d96f7be66983ce4c0c28b1
SHA512 c89a4fd1916dead42d9462f641549463d12872372d509a4971ef2fa68ad10880e17d19a277aa7b2dc5642a35193b84dc7e5dda0535eff793f974dfac62d9a1b1
MD5 SHA1 SHA512

Submit Download

svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBACCCABCABBCCCBBCABAABCAABBBACABBCAABCBACCAACAA.exe
Size 16.3MB
SHA256 f1381a36d685ed87cd93bea5673c19c3bf4ee8ad1e6a145afb6494f1ae9f2f3f
MD5 cb1632453e434d0dbe651c81dd1fcc8c
SHA1 9ff5ce83e9d91e4f9662c2cb47d6d806066e99ad
SHA512 d0ef04407f4816ab358403a8c9fe3fe54972c879b2e0fbf356306ed1d7078309f6f831e82c0197c470959c1191fea450d60423efd6ea2d615f711ca7679e9662
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouq:iZahvQHrc8u3xXJ/f4uUWHn
TLSH
T17907AE13B35681E6C42AE2B88A474223D7BA7C440334A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f1a152815215c2a3e021cbc0f7145a96af20f1da770011db4928802c3992b758
MD5 cda9f06e8317ae92ecd8a017b8023c52
SHA1 aa8940215fb248e68c5456301b899e444983e29f
SHA512 c24949d3a8764d7f8bb0da028ed8885aadc6c4a7e67a8621aa38f4c1284811af7fae4b20b72b2d13cec5299ab34566927a6192c7be4a9f701932111e0892f99d
TLSH
T17B119471B4EAD8B3F9332CDB5511DAC31CB426CFAC9CAA15D3090219B6D5C31DE568E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 82958d61371b9db018e3e000d6c2acbbddba23c7f68bc0dbb85530737bfd4dce
MD5 c3b144d9d8e2b77607c4f03e88420fd8
SHA1 2424d678f8370a56faa7891099ffdd28965e0150
SHA512 a91976596c64b47ec4c7a040ccc78694e47887b4a77dde74205643f1dde21ac6795dbc41bc7f2ae9a72c88586b0ac7314f626cf254321143f3178fc861ccc01e
TLSH
T13721D771B4EAD8B3F9332CCB5511DAC21CB426CFAC9CAA15D3090119B6D5C31DE568E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3064-70-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/3064-1568-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/3464-0-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/3464-7-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4424-968-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/5008-31-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download